@jimp/plugin-shadow

Build provenancecaution

No build attestation or trusted-publisher information is present. This weakens publication transparency, although it is a supply-chain hygiene gap rather than evidence that the release is unfit.

Release historycaution

The package has a long history with 235 releases since 2018, but only one release in the last 12 months. The latest release is recent, which partly offsets the otherwise sparse current cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. A recent release partly compensates, but the lack of recent commit activity leaves maintenance continuity uncertain.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, showing a defined build system. No security scanning tools were detected, which is a modest repository-hygiene gap.

Security policycaution

The repository has no security policy. This reduces transparency about vulnerability reporting and handling, though it does not by itself indicate abandonment.